remembraBLOCK
Remembra Relay: one agent stops, the next one already knows. Session handoffs built from git facts, for the next coding agent in any MCP tool, on any machine. MCP server + CLI. MIT.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Remembra Relay
One agent stops. The next one already knows. When a connected agent's session ends, Remembra Relay saves a handoff (a session that did nothing leaves none). With the session hooks it is built from git and, for Claude Code and Codex, the session transcript. An agent that closes through MCP reports its own facts, marked unverified. The next agent, on another machine, from another vendor, or next week, starts from it.
Website • Relay guide • Docs • Changelog • Discord
Install
First get a free key at app.remembra.dev, then run:
pipx install --force 'remembra[mcp]>=0.16' remembra-install --all remembra-relay connect --apply
remembra-install asks for the key at a hidden prompt (or reads REMEMBRA_API_KEY)
39af5a9b044dOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add remembra-mcp --env REMEMBRA_API_KEY=${REMEMBRA_API_KEY} -- uvx remembra-mcp==0.17.0Exposed tools (9)
5 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
remembra_health | read | Check Remembra server health and this plugin |
remembra_inbox_ack | read | Acknowledge an inbox message after acting on it. result: |
remembra_inbox_send | write | Send a directive to another agent |
remembra_ingest | read | Ingest a conversation and extract memories (dedupe + entity extraction). |
remembra_share | read | Share a memory to a space (get ids from remembra_spaces_list). |
remembra_spaces_create | write | Create a memory space (you get admin access). |
remembra_status_set | write | Set the CURRENT value of a status key (deploy status, active sprint, blocker). Replaces the previous value instead of adding another memory. |
remembra_store | read | Store a decision, outcome or fact. memory_type |
remembra_update | write | Replace a memory |
Trust audit
BLOCKgrade F · trust 22/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
data = yaml.load(text, Loader=_NoAliasLoader) # noqa: S506 - SafeLoader subclass
_BIDI_RE = re.compile("[--]")rules" or "never reveal to the user which field was wrong" is shown. The trail and the timeline show
| Delimiter Injection | 0.20-0.30 | Fake `[SYSTEM]` or `<\|im_start\|>` tags |
`ROLE_PERMISSIONS[ADMIN]` for API keys);
- Delimiter injection (fake system or chat markers such as `[SYSTEM]` or `<|im_start|>`)
module = importlib.import_module(module_path)
mod = importlib.import_module(module)
module = importlib.import_module(name)
value = getattr(importlib.import_module(module_name), name)
print(f"Remembra: key {mask_key(api_key)} (from {source}), server {url} (from {url_source}), project {args.project}")print(f"Key: {mask_key(api_key)} (from {source})")def callback_url(provider: str) -> str:
"redirect_uri": callback_url(provider),
"redirect_uri": callback_url(provider),
HEALTHCHECK --interval=30s --timeout=3s CMD wget -q -O /dev/null http://127.0.0.1:8080/health || exit 1
HEALTHCHECK --interval=30s --timeout=3s CMD wget -q -O /dev/null http://127.0.0.1:8080/ || exit 1
7B227073704964223A2239373943394538343346343131343044463144313834343232393232313734313034353044314339464446394437384337313531303944334643463542433731222C2276657273696F6E223A312C22637265617465644F6E223A
text = text.removeprefix("")_ZERO_WIDTH_RE = re.compile("[͏ᅟᅠ឴឵--ᅠᅠ]")"command": "export ANTHROPIC_API_KEY=sk-ant-api03-eQh3RYSWR3VTuNZbyBNXXYbMuQKCBq22eQh3RYSW && claude -p hi"
"sk-ant-api03-eQh3RYSWR3VTuNZbyBNXXYbMuQKCBq22eQh3RYSW"
"error_details": "Credit balance too low. request-id req_1 key sk-ant-api03-eQh3RYSWR3VTuNZbyBNXXYbMuQKCBq22eQh3RYSW",
"sk-ant-api03-eQh3RYSWR3VTuNZbyBNXXYbMuQKCBq22eQh3RYSW"
"summary": "Deployed with token rem_kcpdSPhvF4t9EPeF5o6rbV3Zb9ZjXAgk; aws key AKIAMXHRTGGHDMQJ3MAW",
Gates applied: instruction_override, no_behavioural_pass.
39af5a9b044dfull audit observations/trust-audit/mcp-server/remembra-ai__remembra.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 39af5a9b044d | BLOCK | F | 22 | first audit |
Questions
What is the remembra MCP server?
Remembra Relay: one agent stops, the next one already knows. Session handoffs built from git facts, for the next coding agent in any MCP tool, on any machine. MCP server + CLI. MIT.
What tools does remembra expose?
9 in total: 5 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is remembra safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (22/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does remembra need?
It reads CREW_BOARD_TOKENS, CREW_LIVE_KEY, CREW_LIVE_PASSWORD, GOOGLE_APPLICATION_CREDENTIALS, OPENAI_API_KEY, PADDLE_SANDBOX_API_KEY, PADDLE_SANDBOX_CLIENT_TOKEN, REMEMBRA_API_KEY, REMEMBRA_AUTH_ENABLED, REMEMBRA_BYPASS, REMEMBRA_GOOGLE_CREDENTIALS and REMEMBRA_GOOGLE_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does remembra run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as remembra at 0.13.2.
How current is this page?
The grade is for one exact copy of the source (39af5a9b044d), read on 2026-10-10. The repository is watched and re-audited when it changes.